Skip to main content
AD Academy
Back to all events
4624Security (DC / client)AuthenticationINFOLast updated:

Successful logon

What it means

A successful sign-in. Logon Type tells you how: 2 = local, 3 = network (share), 10 = RDP, 5 = service.

When it is normal and when it is suspicious

Normal: logons during work hours from the usual host. Suspicious: Logon Type 10 (RDP) as admin at night, or Type 3 from an unknown address.

First steps

  1. 1Check Logon Type and Source Network Address — where the logon came from.
  2. 2Type 10 (RDP) with an admin account at an odd hour deserves a look.
  3. 3Correlate with 4625 at the same time: a password spray that finally worked.

Fields worth checking

FieldWhat to look at
Logon Type2 = local, 3 = network, 5 = service, 10 = RDP. The type changes the whole interpretation.
Source Network AddressWhere the logon came from. An address outside the internal network warrants a check.
Logon IDUnique session identifier — use it to link to 4634 and to in-session actions.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.